Why this belongs at work
Employees receive information from many directions: email, chat tools, social media, industry newsletters, customer messages and the rumor mill. Some of it is accurate and some is not. A false claim can lead to bad decisions, wasted time, damaged relationships or financial loss. A convincing but fraudulent request can lead to a security incident.
Media literacy at work is therefore not an abstract exercise. It is part of how an organization stays accurate, secure and fair. This guide gives employers a practical, low-cost approach. It is general information, not legal or human-resources advice, so check local employment rules and your own policies before making changes.
Where unreliable information comes from
It helps to name the main channels so you can focus effort where it matters.
- Internal rumors. Speculation about layoffs, reorganizations, pay or individuals spreads quickly when people lack information.
- Scams aimed at staff. Messages that pretend to be from a manager, vendor, bank or government office, asking for payments, gift cards or login details. Examples include phishing emails and fake invoices, along with fake job offers aimed at employees’ personal accounts.
- Industry claims. Marketing statistics, “studies” with unclear sources and confident predictions that influence purchasing or strategy.
- Social media and forwarded content. Staff may bring in or share material that is misleading, which can cause embarrassment or conflict.
- Automated tools. Text generated by an assistant can contain errors presented as fact.
Build habits, not just rules
A policy that nobody remembers does little. Aim for a few shared habits that are easy to recall.
Pause on urgent requests
Most fraud depends on pressure. Make it normal to slow down when a message demands immediate action, secrecy or an unusual payment. A reasonable standard is that any request involving money, credentials or sensitive data is confirmed through a second, known channel, such as calling a number already on file rather than one given in the message. This is also a key defense against official impersonation, where scammers pose as authorities or senior staff.
Check before forwarding
Encourage staff to ask three things before passing anything along: where did this come from, is it the original, and does it need to be shared? Forwarding unverified warnings or announcements can create panic.
Name the source
In internal documents and presentations, ask people to say where figures and claims come from. A line such as “source: our Q3 sales report” or “source: vendor claim, not independently checked” makes assessment much easier. It also discourages quoting statistics with no origin.
Separate fact, interpretation and opinion
In meetings and reports, label which is which. “Sales fell by this amount” is a fact that can be checked. “Customers are losing trust” is an interpretation that needs support.
Treat generated text as a draft
If staff use writing or research tools, set a clear expectation that they remain responsible for accuracy. Anything sent to customers, regulators or the public should be checked by a person against reliable sources.
Simple policies that help
Keep policies short, written in plain language and visible. Consider including:
- A verification step for sensitive requests. Payments, changes in bank details, password resets and data sharing should require confirmation through a separate channel.
- A no-blame reporting route. People should be able to report suspicious messages or their own mistakes quickly without fear of punishment. Early reports are the best protection, and fear of blame leads to silence.
- A single place for official news. Decide where important announcements will be posted so staff know what counts as official.
- Guidance on external claims. If your organization makes public claims, require a named person to confirm the source before publication.
- Social media expectations. State clearly what staff may and may not share on behalf of the organization, and make clear that personal views are their own. Coordinate with your acceptable use policy where one exists.
- A policy against harassment and false accusations. Spreading false claims about colleagues can harm people. Make clear how complaints are handled, and see our material on workplace harassment for how that can unfold.
Have a lawyer or qualified adviser review anything that affects employment terms.
Reduce the room for rumors
Rumors fill gaps. Leaders can reduce them by:
- sharing what is known, even when the news is incomplete, and saying when more will be shared
- using regular, predictable updates rather than only responding to crises
- offering a way for staff to ask questions, including anonymously where appropriate
- correcting inaccurate information promptly and calmly, without blaming those who repeated it
Avoid claiming certainty you do not have. Saying “we don’t know yet, and here is when we expect to” builds more trust than a confident statement that later changes.
Train in short, practical bursts
Long annual sessions are easily forgotten. Shorter refreshers tend to work better:
- a ten-minute segment at a team meeting using a real, anonymized example
- a monthly “spot the problem” message with a sample suspicious email or claim
- onboarding material that explains who to contact and where official information lives
Pair practice with explanations. Safety training can be tailored to your size and sector, and small business training can be simple and inexpensive. Include examples relevant to your industry, and cover how to protect accounts with two-step verification.
Model it from the top
Staff follow what managers do. If leaders forward unverified stories, speak in absolutes or dismiss questions, policies will not matter. If leaders say “let me check that,” cite sources and admit mistakes openly, others copy them.
Keep it fair and proportionate
Do not turn media literacy into surveillance or a way to police personal opinions. The aim is to help people handle information well, not to control what they think. Be transparent about any monitoring you do, follow local law and respect privacy.
Start small. One verification rule, one reporting route and one short session can make a noticeable difference, and you can expand from there.